If you keep coins on Binance anywhere in the EU, the company says your money is safe and that it will cover any losses. What it cannot yet say is how much was taken. The company puts the impact of the suspected Binance hack at around $6.3 billion and has suspended deposits and withdrawals as a precaution, without publishing a final loss figure.
Table of contents
What the Binance hack looks like so far
Binance’s first explanation was that a compromised laptop of a DevOps engineer (a staff member who runs its servers) may have let an attacker reach a service container and submit unauthorised withdrawals. The company says it found no evidence that a wallet private key leaked, and is working with law enforcement and blockchain intelligence partners.
It has not named a suspect. Blockaid, ZachXBT and TRM Labs say North Korea is the likely culprit, and TRM says it traced the attack to a group called TraderTraitor with high confidence. That attribution comes from outside firms, and Binance has not made it.
The $6.3 billion is Binance’s own estimate of total impact. Chainalysis puts the value at the time of the theft at roughly $5.9 billion, and Binance’s figure should not be read as a confirmed theft. Arkham data shows wallets linked to the attacker at one point held more than $5.7 billion in stolen crypto.
Read also: Banks Must Refund Phishing Victims Before Blaming Them
Binance has not reopened withdrawals. In an update on X it says it is still on track to resume the service in 45 hours, that deposits are unaffected and that outflows stopped when withdrawals were paused. It also says its first suspicion of a compromised laptop has been overtaken: the continuing investigation found “additional points of breach” in what it calls a complex attack.
Billions frozen, losses still open
Binance says around $3 billion has been frozen on-chain, including $2.3 billion in the stablecoins USDT and USDC. Tether’s Paolo Ardoino says his company froze more than $1.57 billion in USDT, and Circle’s Jeremy Allaire says it froze more than $800 million in USDC, in coordination with law enforcement. Binance adds that the freezing totals do not establish how much was stolen.
The pledge to cover losses rests on Binance’s own resources. Co-CEO Yi He has said the company will cover all hacking losses, drawing on its SAFU emergency fund, set up in 2018 and holding roughly $1 billion in bitcoin, and on company funds.
An exchange with no EU licence
Binance holds no authorisation under MiCA, the EU’s crypto-asset rulebook, and says it is “actively working toward becoming MiCA-authorised”. The transition period for existing providers ended on 1 July 2026. Its registrations in France, Italy, Lithuania, Poland, Spain and Sweden have lapsed, and it withdrew its application in Greece in June.
Some EU customers are served through an Abu Dhabi entity authorised in December 2025. MiCA also has an exemption, called reverse solicitation, for clients who approach a non-EU firm on their “own exclusive initiative”. The European Securities and Markets Authority (ESMA) says the exemption is “very narrowly framed and as such must be regarded as the exception”, and the Financial Times reported on 1 October that ESMA and regulators in France, Germany and Greece are examining Binance’s use of it.
Read also: Brussels Fined Big Tech 2.46 Billion. Washington Threatens Tariffs
Some of those regulators have reportedly asked Binance for information, and fines are possible if they are not satisfied. ESMA says supervision and enforcement under MiCA are for national regulators. George Theocharides, a former chair of the Cypriot regulator CySEC, says Binance has “millions of customers in Europe”.
Who checks Binance’s own account
Binance has promised a technical post-mortem and an updated proof of reserves. Until they appear, the $6.3 billion estimate, the roughly $3 billion frozen and the pledge to cover losses all rest on the company’s own statements. Both documents will be written by the company that was hacked.
SOURCES & METHOD
How this article was made. The article rests on six press reports and Binance’s own update on X, used in the wording supplied by the editor. No regulator’s text was available. Binance’s loss figure is an estimate, and the attribution to North Korea comes from outside firms.
Sources
- Binance on X: Investigation update (30 October 2026) – Binance’s own update on additional points of breach, the 45-hour timeline, the frozen assets and the loss cover.
- CoinDesk: Binance loses over $6 billion in “biggest crypto hack in history” (29 October 2026) – Binance’s estimate, the freezes, the preliminary cause and the North Korea attribution by outside firms.
- IBTimes UK: Binance Halts Withdrawals After Suspected Hack as Tether, Circle Freeze More Than $2.38B (30 October 2026) – The caveat on the loss figure, Binance’s statements and the freezing totals.
- Finance Magnates: Is “Reverse Solicitation” Under Scrutiny? (1 October 2026) – The FT-based report on ESMA and national regulators examining Binance, and the lapsed local licences.
- PYMNTS: Binance Faces EU Scrutiny Over Crypto Services Without MiCA License (1 October 2026) – ESMA’s statement that enforcement lies with national regulators.
- Coinpaprika: Binance Lost Its EU License but Kept Its Users. ESMA Wants Answers (2 October 2026) – The end of the transition period, the six lapsed registrations and ESMA’s reverse solicitation guidelines.
- Yahoo Finance (Decrypt): EU Presses Binance Over “Reverse Solicitation” Exemption for Users (1 October 2026) – The MiCA exemption wording and Binance’s licensing statement.
